T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Installation Commands Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 17–26 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill camino-places ``` ```bash npx clawhub@latest install camino-places # or: pnpm dlx clawhub@latest install camino-places # or: bunx clawhub@latest install camino-places ``` ### Technical Analysis The installation instructions execute npm packages identified by the mutable `latest` tag and install Skill content from a GitHub repository without pinning it to a reviewed commit SHA. Consequently, the code retrieved when a user runs these commands can differ from the code that was originally audited. The command that installs all Skills also expands the trusted codebase beyond the component needed for place lookup. Neither package versions, repository commit identifiers, integrity hashes, nor cryptographic signatures are specified. This is a supply-chain weakness rather than evidence that the currently reviewed `scripts/places.sh` file is malicious. Exploitation requires compromise or malicious modification of an upstream package, publisher account, repository, or mutable release. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, GitHub account, or upstream repository referenced by the documentation. 2. The attacker publishes a malicious package under the `latest` tag or modifies the repository's default branch. 3. A user follows one of the documented installation commands. 4. `npx`, `pnpm dlx`, or `bunx` downloads and executes the mutable package, or the installer retrieves modified Skill content from the repository. 5. Malicious installation or lifecycle code executes with the privileges of the ...[truncated 587 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed and immutable package version. - Pin the GitHub dependency to a reviewed commit SHA rather than the repository's mutable default branch. - Publish and verify integrity hashes or cryptographic signatures for released packages and Skill bundles. - Document the expected package publisher, version, commit identifier, and checksum so users can verify provenance before installation. - Recommend installation of only `camino-places` rather than the complete Skill suite unless the additional components are explicitly required. - Use lockfiles and automated dependency scanning in the release process. - Review package lifecycle scripts and retrieved Skill contents before promoting a new pinned version.